For the LPIPS robustness evaluation shown in Fig. REF , we use the following settings: Fast Lagrangian Attack from [1]} using their suggested hyperparameters and AlexNet as the network to compute the LPIPS distance.
For the \(\operatorname{\mathbf {\ell }}_2\)  robustness evaluation, we use the APGD-CE attack [2]} with 100 iterations and 5 random restarts.
